Controlled transmission across packet network

ABSTRACT

Control over the movement of packets is exercised by edge nodes of a network mapping the addresses of incoming packets in accordance with a prespecified functional mapping P. Remote sources of packets are provided address information that is mapped with a prespecified functional mapping Q, where mappings P and Q are such that P(Q(j)=j. The mapping change at regular intervals, or upon the occurrence of specified events, and with each change, the communicating the remote source is provided with a different mapped address to be used.

BACKGROUND

This invention relates to packet communication and, more particularly,to fee-based communication across multiple packet networks.

Most US telecommunication providers currently employ packet networks totransport both voice and-data signals. Such a network, shown in FIG. 1,transports information in packets that are routed from router to router(e.g. from router 301 to router 302), via links (e.g., 303), from anoriginating point in the network to a terminating point in the network.

FIG. 1 depicts a typical arrangement for coupling a user 11 in onelocation (for example, New York) to a user 12 in another location (forexample, Los Angeles). User 11 is connected to a local circuit-switchednetwork 100 in New York (e.g., Verizon), and more particularly to acentral office 12 within network 100. Similarly, user 21 is connected toa local circuit-switched network 200 in Los Angeles (e.g., PacTel), andmore particularly to a central office 22 within network 200.

When a call from user 11 to user 21 is assigned to traverse packetnetwork 300 that employs, for example, the IP protocol, central office12 sends signaling information to VoP gateway 10 that couples network100 to packet network 300. Gateway 10 translates and converts thereceived signaling information to a chosen signaling format, for exampleMedia Gateway Control Protocol (MGCP) over IP, and forwards thesignaling packets to call agent 15. The signaling packets containinformation such as the identity of the called party and the identity ofthe calling party. Call agent 15 queries database 16 (with thedestination of called party 21) to identify an appropriate call agentfor completing the connection, and receives the IP address of PacTelcall agent 25. Call agent 15 then sends an Initial Address Message (IAM)to call agent 25, requesting the IP address of the appropriate VoPgateway for completing the call. Call agent 25 queries its database(26), obtains the IP address of VoP 20, and forwards that information inan Address Complete Message (ACM) to call agent 15. The communicationpath between the call agents is not shown, for sake of clarity. Thecommunication itself can employ the Bearer Independent Call Control(BICC) protocol. The IP address of VoP gateway 10 is communicated to VoPgateway 20 by call agent 25, the IP address of VoP gateway 20 iscommunicated to VoP gateway 10 by call agent 15, and henceforth gateways10 and 20 can communicate using the respective IP addresses byemploying, for example, Real-Time Protocol (RTP).

Although the FIG. 1 arrangement depicts VoP gateways 10 and 20 couplingpacket network 300 to respective Public Switched Telephone Networks(PSTNs) 100 and 200, they can be connected directly to user devices suchas telephones. The functionality of a VoP gateway can even be embeddedin devices to form packet phones or integrated packet-circuit voiceintegrated switching systems. When embedded in Customer PremisesEquipment such gateways are sometimes called Media Terminal Adapters(MTAs). These can also be called untrusted end points. Call agents aresometimes called Call Servers or Call Proxy Servers.

When there are multiple call agents in a network arrangement, as shownin FIG. 1, each one typically communicates with a subset of gatewaysunder its control. Each of these subsets is a domain. When it is desiredto set up a call between domains, for example, domains 306 and 307, therespective call agents communicate with each other, as described above.

In the above example, network 300 was chosen to employ the InternetProtocol (IP), but it should be understood that Asynchronous TransferMode (ATM), Frame Relay (FR) or any other packet protocol that issuitable for transporting voice packets may be employed. The call set-upprocedure for non-IP packet networks is similar to the procedureoutlined above for IP networks.

A highly desirable characteristic of the FIG. 1 arrangement is theseparation of Call Control from Connection Control. In this model, thetechniques, signaling messages, procedures, etc., used to establish thelogical voice connection between end-users is independent of thetechniques, signaling messages, procedures etc., used to establish theconnection that carries the voice packets in the packet network. In thisway, customers can have and retain the same voice features regardless ofwhether the underlying transport technology is circuit-switched orpacket-switched and regardless of what packet protocol is used, as longas it meets the basic requirements for a voice connection.

As long as the packet network is a single and homogeneous network,packets can travel throughout the network unimpeded, as implied by FIG.1. However, neither Verizon nor PacTel own a packet network that extendsfrom New York to Los Angeles, and their networks do not even meet. Thatpresents no technological problem when the individual networks thatcomprise packet network 300 employ the same formats and the sameprotocols. When they do not, however, the packet voice must be convertedfrom a first format and protocol to a second format and protocol; oftenvia an intermediate step of converting signals to conventionalcircuit-switched format. This is typically done through a pair ofback-to-back gateways. Even if the various networks that comprisenetwork 300 use identical protocols, when the networks are owned bydifferent entities the back-to-back gateways are nevertheless used atthe interfaces where network ownership changes. The reason for this isquite simple: both Verizon and PacTel want to get paid for providing theconnection between users 11 and 12, and the back-to-back gateways at theinterfaces where ownership changes can exercise the desired connectioncontrol. Otherwise, one or both of the telecommunication providers mightget shortchanged.

For example, once gateways 10 and 20 have obtained each other's IPaddresses, there is no reason for them to use the call agents to set upthe call. Of course, when gateway 10 is under control of thetelecommunication service provider of domain 306, user 11 cannotcommunicate over network 300 without permission from the provider.However, as indicated above, MTAs connect directly to the packetnetwork, and those are not under control of the telecommunicationservice provider.

While obtaining transmission for “free” might be fine for the publicInternet, a carrier that provides an IP based network that meets strictQuality of Service (QoS) objectives required for high quality voicebelieves to be entitled to be compensated for the use of this IPnetwork. The process that insures the compensation is under control ofthe call agent, where all billing for usage as well as any special callfeatures may be centralized. In addition, voice is usually billed on aduration basis, not a packet basis, and the packet network has noknowledge of call duration. Therefore, it is required that gateways 10and 20 (or corresponding MTAs) be allowed to send packets to each onlywhen allowed by the call agents.

If, instead, one were to decide to bill on a packet usage basis,governed by the IP network, the gateways might use the call agent toexchange IP addresses but never use the IP network to exchange voicepackets, preferring to use some other (cheaper) network. Therefore, evenin the case of billing on a packet usage basis, it is required thatthere be an affirmative control by the call agent of the connectionsthrough network 300.

Another consideration is that, for security reasons, users may not wanttheir “true” IP address to be disclosed to others. This isparticularly-true if a user is in a private network behind a proxyfirewall.

One solution to this problem is presented in FIG. 2, where call agent 15communicates with a special router 313 at the edge of domain 306 (vialine 308), and call agent 25 communicates with special router 323 at theedge of domain 307 (via line 309). These special edge switches routepackets only if they carry an IP address that was explicitly authorizedby a call agent. In specifying the authorized IP addresses, the callagent is also able to specify the QoS level being paid for, and thatprovides the edge switches with information necessary to choose betweenpackets that are to be routed vs. packets that are to be buffered, whenthe transmission load calls for buffering of some packets. To prohibitthe gateways from being used without the packet network, the IPaddresses are never communicated end to end. Call agent 25 maps the IPaddress that leads to user 21 into an arbitrary IP address andcommunicates the arbitrary/true IP address mapping to its edge switches.It then communicates the arbitrarily selected IP address to call agent15 and, thence, to gateway 10. Similarly, call agent 15 maps the IPaddress that leads to user 11 into an arbitrary IP address andcommunicates the arbitrary/true IP address mapping of to its edgeswitches. It then communicates the arbitrarily selected IP address tocall agent 25 and, thence, to gateway 20. In this way, gateways 10 and20 never know the true IP addresses of each other.

There are a number of problems with this solution.

This solution requires precise timing between the packet network and thecall agents. If the messages to the edge switches are sent too soon,customers can obtain free service (for a short duration); if too late,the voice path might not be established by the time gateway 20 isanswered, resulting in clipping of the initial speech.

The call agent must know the characteristics of the packet network,because the procedures for establishing connections are different foreach type, and the packet network may provide permanent connections(PVCs), temporary connections (SVCs), or no connections at all (as inIP).

An end-to-end connection may require several networks: private networks,local public networks, inter-exchange carrier networks, and/orinternational networks. This communication must take place in each ofthese separate networks, adding to the complexity.

For reliability, it is desirable to have the option to serve aparticular gateway by any one of a multiple number of call agents andedge switches. However, for any given call, only one specific callagent/edge switch pair is involved. Reliably establishing thecommunication between the right ones in real time is difficult andrequires the call agents to have accurate knowledge of the connectionnetwork topology as well as either additional network elements to keepthe status of each call agent and edge switch and/or some kind ofbroadcast mechanism to insure the “right” edge switch gets theinformation. Additionally, in some cases (e.g. failure), the connectionmay even be reestablished in the middle of a call, again, preferablywithout interaction with, or even knowledge of, the call agent. Theissue of reliability is further complicated by the distributed nature ofmost edge switches themselves, with termination cards within the edgeswitch performing much if not all of the connection processing. Theconnection request will be received by one termination card,necessitating the same communication needs as between the callagent/edge switch, in that either the correct card must be identifiedand informed, or all requests must be broadcast to all cards.

SUMMARY OF THE INVENTION

The prior art problems are overcome and an advance in the art isachieved by eliminating the need for a call agent to send mappinginformation directly to edge switches. This is achieved by all edgenodes mapping received packet addresses in accordance with apredetermined function. The mapping according to the function may changeat regular intervals, or upon the occurrence of specified events, andwith each change, the communicating user is provided with a differentaddress to be used. In one embodiment, the mapped destination addressthat is created is developed through a process that encrypts the trueaddress. The changed mapping in the context of an encryption scheme canbe effected by merely specifying a different random seed value in theencryption algorithm.

BRIEF DESCRIPTION OF THE DRAWINGS

-   -   a FIG. 1 describes the prior art arrangement of establishing        voice connections over a packet network;

FIG. 2 describes the use of back-to-back edge switches between networksthat aim to insure no unauthorized transmissions between networks;

FIG. 3 shows an arrangement where edge switches perform mappings withoutdirect communication from call agents;

FIG. 4 presents a signal flow diagram in conformance with the principlesdisclosed herein; and

FIG. 5 shows an arrangement with two networks interposed between thenetworks of the two communicating devices.

DETAILED DESCRIPTION

FIG. 3 illustrates a packet network arrangement that comports with theprinciples of this invention; and with respect to those principles, itis similar to the FIG. 1 arrangement. For illustrative purposes,however, instead of a single network as shown in FIG. 1, FIG. 3 depictsan ATM network 310, and an ATM network 320; instead of gateway 10, PSTN100 and user 11, there is an MTA 13 that is connected to switch 314within network 310; and instead of gateway 20, PSTN 200 and user 12,there is an MTA 23 that is connected to switch 324 within network 320.

It is noted that the switches in ATM networks perform essentially thesame function as do the routers in IP networks. In this disclosure,therefore, the term “node” is used to subsume both a router and aswitch.

For convenience, it may be assumed that MTA 13 is in New York andnetwork 310 is owned by Verizon, that MTA 23 is in Los Angeles andnetwork 320 is owned by PacTel, and that the connection between networks310 and 320 is either direct, or circuit-switched, over a network ownedby an inter-exchange carrier (not shown). Also, MTA 13 homes-in ontoedge switches 311 and 312, to illustrate that, for increasedreliability, two parallel paths may be conditioned to carry a connectionbetween MTAs 13 and 23. Likewise, MTA 23 homes-in onto edge switches 321and 322.

In accord with the principles disclosed herein, edge switches of apacket network—being the only points of general entry from anotherpacket network translate a predetermined portion of the address ofincoming packets in accordance with a predetermined functional mapping.The portion that is functionally mapped is that portion that is expectedto have been previously mapped by another functional mapping. Theportion that is not mapped is that portion that is considered to be“clear.”

No information needs to be communicated from a call agent to itsassociated edge switches. This mapping may be employed in the edgeswitches of the entire network (e.g. network 310), in edge switches of aparticular domain, in a particular edge switch of the network, or evenassociated only with a particular call. The mapping may be throughoperation of a specified functional expression, or table-based.Illustratively, the mapping may be a decryption of a value that, whendecrypted, yields the address of the destination MTA.

Further in accord with the principles disclosed herein and in cognizanceof the actions taken at edge switches, a remote source of packets thatarrive at the edge switches of a network and are destined to an MTA at agiven network address of the network (or, expressed more generally,destined to a port that has a network address) is not provided with thisgiven network address of the destination MTA but, rather, is providedwith a mapped version of the given address. The mapped version of thegiven address is such that when processed by the edge switches (i.e.,mapped/decrypted) results in the true network address of the destinationMTA. For example, if the destination MTA has a network address , theaddress provided to a remote source of packets is A•(), where “A”corresponds to a concatenated address portion that is in the “clear,”while the () is the mapped network address of the MTA. The remote sourcesends out packets that carry the address A•(). Based the clear portionof the address, the packets reach the network where the desired MTA islocated, and the edge switches apply the mapped portion of the incomingaddress, (), to function , to yield (()), which equals because thefunctions and are chosen to have this property.

Because the call agent already knows the addresses of the MTAs in itsdomain, it is advantageous keep the mapping function () in the callagents.

The mapping that is carried out by the edge switches for general packetcommunication may be long-lived, or short-lived; for example, valid onlyfor one minute. In applications where the mapping function is not fixed,the mapping function must change in synchronism with changes in mappingfunction (or vice versa). In applications where the changes occur basedon time of day, for example, this can be achieved by use of a commonclock. Illustratively, the changes in functions and might take place inresponse to a reception of a broadcast signal.

To illustrate further, a network might use a pair of complementaryencryption keys for the functions and (i.e., (())=). In such anarrangement, the remote MTAs are given an address that has beenencrypted with the key that corresponds to , and the edge switchesdecrypt with the key that corresponds to . Both keys may bealgorithmically developed using a starting value (sometimes called a“seed”). For example, the arrangement between the call agents and theedge switches might be that both entities work off a common set of seedvalues that are respectively pre-stored in a memory of the call agentand in a memory of the edge switches, and each minute of the day theyindependently create their respective keys by accessing the same (orcomplementary) seed values. Encryption functions such as the onesdescribed above are well known in the art. See, for example, “AppliedCryptography,” by Bruce Schneier, John Wiley & Sons, 1996.

The synchronization between the call agent's interval clock when mappingfunction is changed, and the clock interval mappings when the edgeswitches change the mapping function need not be precise and, therefore,there is no need for the call agent to communicate directly with theassociated edge switches to insure this synchronization. Even for arelatively short time interval such as one minute, a time offset betweenthe call agent and the edge switches of a few seconds is not a problemas long as the edge switches are quicker to switch to a new mappingfunction than the associated call agent, but continue to remember theold mapping function. Time-adjacent mappings can be selected so that amapping of an address that was mapped in accordance with the immediatelyprevious mapping function yields an address that is recognized to beincorrect. In such an event, the previous mapping function is used toproduce the correct 64 mapping.

FIG. 4 presents a signal flow diagram for an implementation in accordwith the principles of this invention for the FIG. 3 arrangement. Forthis illustration, it is assumed that networks 310 and 320 are ATMnetworks using Bearer Independent Call Control (BICC) protocol for, callagent to call agent signaling, and establishing Switched VirtualCircuits (SVCs) for connection control.

When MTA 13 wishes to place a call, it sends a service request to callagent (CA) 15 (line 101—e.g., Q.2931 protocol). In sending the servicerequest, MTA 13 provides information about its own network address, andthe identity of the called party (for example, MTA 23). In response tothe latter, call agent 15 queries its database (line 102) for theaddress of a call agent that handles the domain within which MTA 23resides. Concurrently, it identifies the applicable mapping function, ₁₅and, once the database responds (line 103), call agent 15 is inpossession of the following:

-   -   (a) the address of call agent 25,    -   (b) the “clear” portion of an ID for reaching the domain of MTA        23, A₃₂₀,    -   (c) the mapping function ₁₅ ,    -   (d) the address of MTA 13 (X1),    -   (e) the “clear” portion of an ID for reaching the domain of MTA        13, A₃₁₀, and    -   (f) an identification of the called party MTA 23.        The subscript (15) in ₁₅ designates the call agent that provides        the mapping function, and the superscript () is an index that        designates a particular mapping function; i.e., ₁₅ ±₁₅ when ± .        Call agent 15 maps X1 with ₁₅ , and proceeds to send an Initial        Address Message (IAM) to call agent 25 (line 104) that includes        ₁₅ (the result obtained by mapping address X1 with mapping        function ₁₅ ), the “clear” portion of an ID for reaching its        domain, A₃₁₀, and an identification of the called party.        Illustratively, call agent 15 communicates with call agent 25        via the SS7 signaling network (not shown for sake of clarity).

When the IAM is received, call agent 25 queries its database (line 105)to identify the network address of MTA 23. Having received the networkaddress of MTA 23 (X2) from its database (line 106), call agent 25 mapsaddress X2 with mapping function ₁₅ to arrive at ₂₅ (X2). Call agent 25then provides MTA 23 (line 107) the values A₃₁₀•₁₅ (X1), and A₃₂₀•₂₅(X2), allowing MTA 23 to send out a “connect” message (line 108) toA₃₁₀•₁₅ (X1).

In the illustrative FIG. 3 network, which is an ATM network, the“connect” message traverses network 320 towards the destinationspecified by the “clear” portion of the address, to wit, A₃₁₀, and thenthrough network 310 based on the mapped address ₁₅ (₁₅ (X1)). That is,based on provisioned information within the switches of network 320, the“connect” message is routed to edge switch 321 (for example). Edgeswitch 321 uses its provisioned information to route the “connect”message to edge switch 311 (line 109) where the mapped address portion,₁₅ (X1), is applied to mapping function ₁₅ . Presuming that the correctmapping information was provided by call agent 15, the mapping withinedge switch 311 yields the address X1 and, thereafter, based onprovisioned information within the switches of network 310, the“connect” message is routed to MTA 13 (line 110). As the “connect”message proceeds to traverse the networks, a Virtual Path Identifier(VPI) and a Virtual Circuit Identifier (VCI) are selected for each linkin the connection from MTA 23 to MTA 13, and a mapping is establishedwithin each switch in the traversed path that associates a particularoutput VPINCI for the input VPI, VCI pair. This allows future packets tobe switched and, thus, routed strictly based on the VPI and VCIidentifiers, in accordance with conventional ATM operations.

The “connection” message from MTA 23 also includes the ID of thedestination network, A₃₂₀, and ₂₅ (X2). Once the “connect” messagearrives at MTA 13, the MTA is able to send an acknowledgement message toMTA 23 by addressing the acknowledgement message to A₃₂₀•₂₅ (X2). Theacknowledgement message traverses network 310 and then network 320, andin the process it establishes appropriate mappings in the traversedswitched to establish a VPI, VCI identifier for each link in the pathfrom MTA 13 to MTA 23, in the manner described above (lines 111-113).

Once the connection paths are established between MTA 23 and MTA 13, andvice versa, communication can proceed in both directions, as depicted bylines 114 and 115 in FIG. 4, with MTA 23 using the address A₃₁₀•₁₅ (X1)and MTA. 13 using the address A₃₂₀•₁₅ (X2).

At the conclusion of each mapping within edge switches 312 and 232, asindicated above, the edge switch ascertains whether the mapped value isvalid. When the mapped value is not valid, the edge switch makes asecond try by mapping with the immediately previous mapping function;for example, ₂₅ (X2) with ₂₅ ⁻¹. If the second-try mapping also resultsin an invalid mapped result, the packet is discarded.

The conversion of the address X₁ to ₁₅ (X1) provides not only security,but also allows call agent 15 to influence the routing decisions made byedge switches in the destination network (edge switch 321). The choiceof alternate routes, where available (here edge switches 311 and 312),can now be made not only in cases of failure, but also for otherpurposes such as to manage traffic and provide QoS.

Note that call agent 15 and call agent 25 need not have any knowledge ofhow packets are routed by edge switch 311 and edge switch 321. Ifconditions change and an edge switch fails or becomes congested, theother edge switches can route around these problems without any actionor knowledge on the part of the call agents, as long as these edgeswitches have knowledge of the appropriate mapping functions. In somecases, this rerouting can be accomplished during the call when thepacket protocol allows this, e.g., in the IP protocol, or someimplementations of the ATM protocol. This rerouting can be accomplishedat call setup without the call agents' knowledge of the connectiontopology and which specific edge switches will be involved in the call.

The description above mentioned that the communication between callagent 15 and call agent 25 may be via the SS7 signaling network. Anotherapproach is to employ the networks that are used for communication (e.g.between MTA 13 and MTA 23). The latter approach, however, needs toinclude the ability of the call agents to reach each other in spite ofthe mappings performed in the edge switches that handle packets that aredestined to MTAs. This can be achieved with the edge switches thatrefrain from applying their mapping function to packets that aredestined to a call agent. Alternatively, call agents may use speciallydesignated edge routes that do not perform any mapping, but arerestricted to route packets only to call agents.

As indicated above, the connection between networks 310 and 320 can bedirect, or through one or more networks. FIG. 5 explicitly illustratesthis condition; with network 330 interposed between networks 310 and320. To simplify the drawing, only one edge node is shown to be involvedin the connection involving networks 310, 320, and 330. Basically, theissue in the FIG. 5 arrangement is how to establish a connection betweenthe networks in consonance with the principles disclosed herein.

There are numerous approaches that can be employed in connection withthe intermediate networks. One approach, for example, has call agent 15identify the intermediate networks and send that information to callagent 25; for example, A₃₃₀•A₃₄₀•A₃₁₀•₁₅ (X1). A “connect” message canthen be addressed from MTA 23 to network address A₃₃₀•A₃₄₀•A₃₁₀•₂₅ (X1),and including the values A₃₂₀ and ₂₅ (X2) within the “connect” messageenables MTA 13 to send an acknowledgement message to A₃₄₀•A₃₃₀•A₃₂₀•₂₅(X2). This approach traverses the intermediate networks without anymappings and inverse mappings, and basically treats the intermediatenetworks as free resources.

When the intermediate networks wish to block traffic except that whichthey get paid for, one approach that can be employed is the functionalmappings-inverse mappings that are disclosed herein. In accordance withthis approach, the traversal through any network is preceded by amapping of an address portion at the incoming edge node and, therefore,the “connect” message that MTA 23 needs to send in the FIG. 5arrangement is addressed toA₃₃₀•₃₅(A₃₄₀)•₄₅(A₃₁₀)•₁₅(X1),and the acknowledgement message is addressed toA₃₄₀•₄₅(A₃₃₀)•₃₅(A₃₂₀)•₂₅(X2).The values A₃₁₀ and ₁₅ (X1) are provided to call agent 25 by call agent15. Call agent 15 obtains the values A₃₄₀, A₃₃₀, and A₃₂₀ from itsdatabase, forwards values A₃₁₀, and A₃₃₀ to call agent 45, and instructsit to send ₄₅ (A₃₁₀) and ₄₅ (A₃₃₀) to call agent 25. Similarly, callagent 15 forwards values A₃₄₀, and A₃₃₀ to call agent 35, and instructsit to send ₃₅ (A₃₄₀) and ₃₅ (A₃₂₀) to call agent 25. Call agent 25 thenprovided MTA 23 with the above values, including ₂₅ (X2), thus supplyingall of the necessary information for setting up a connection.

A similar approach, resulting in the same addressing but not requiringfull knowledge of the path, is for each call agent to determine the nextnetwork in the path, map the previous network's address, and concatenateits “clear” address to the resultant address.

As indicated above, the selection of FIG. 3 network as an ATM networkwas merely illustrative. It should be noted that the principlesdisclosed herein are applicable to other packet technologies, callcontrol protocols and connection methods.

It should be also appreciated that though the mappings performed in theedge nodes, and the mappings performed in the call agents arefunctional, in the sense that given an address the mapped value can becomputed, this computing to obtain the mapped value can be replaced witha look-up table. It should also be appreciated that various, arbitrarilyselected, parameters can be included in the process that chooses themapping functions and . This is particularly so when the call agents andthe edge nodes take their respective cues for changing functions andfrom a received broadcast signal.

1. A method for communicating packets from a packet source in a firstnetwork to a packet destination in a second network, where said packetdestination has a network address X, comprising the steps of:communicating, from an element in said second network to an element insaid first network, an address Y that corresponds to address X mappedwith function ; and mapping, in a node in said second network, at leasta sub-field of an address field contained in packets received from saidfirst network with a function , where and are functions such that((X))=X, where functions and change upon occurrence of an event.
 2. Themethod of claim 1 where said functions and change at regular timeintervals.
 3. The method of claim 1 where said changes to said mappingfunction and mapping function are algorithmically determined.
 4. Themethod of claim 1 where said changes to said mapping function andmapping function are determined by reference to a table that is storedin said element of said second network, and a table that is stored insaid node.
 5. The method of claim 4 where said table in said nodecontains seed values that are used to develop a decryption function toserve as mapping function , and said table in said element of saidsecond network contains seed values that are used to develop adecryption function to serve as mapping function .
 6. The method ofclaim 1 further comprising the step of communicating, from said elementin said second network, an identifier that is instrumental in routingsaid packets from said first network to said second network.
 7. Themethod of claim 1 where said node includes links to elements outsidesaid second network.
 8. The method of claim 7 where said elementsoutside said second network are nodes in a third network.
 9. The methodof claim 7 where said elements outside said second network are links toa PSTN network.
 10. The method of claim 7 where said elements outsidesaid second network are Media Terminal Adapters.
 11. The method of claim1 where said node includes links to nodes outside said second network.12. The method of claim 1 where said element is in said second networkis a call agent.
 13. The method of claim 12 where said call agentimplements communication features for said packet destination.
 14. Themethod of claim 1 where said element in said first network is a callagent.
 15. The method of claim 14 where said step of communicatingemploys a third network for communicating from said call agent in saidsecond network to said call agent in said first network.
 16. The methodof claim 1 where said first network and said second network carryinformation in packet format or switched-circuit format.
 17. The methodof claim 1 where said node in said second network receives said packetsfrom said first network via one or more other networks.
 18. A method forcommunicating Packets from a packet source in a first network to apacket destination in a second network, where said packet destinationhas a network address X, comprising the steps of: communicating, from anelement in said second network to an element in said first network, anaddress Y that corresponds to address X mapped with function : mapping,in a node in said second network, at least a sub-field of an addressfield contained in packets received from said first network with afunction , where and are functions such that ((X))=X; determiningwhether result of said mapping correspond to a valid packet destinationin said second network; and if said step of determining concludes thatsaid result of said mapping does not correspond to a valid packetdestination in said second network, mapping said at least a sub-field ofan address field contained in packets received from said first networkwith a function , which corresponds to the mapping function employed bysaid node prior to a change in mapping function .